Last Friday we announced the recent security advisory released by Microsoft about a vulnerability in the Microsoft Jet Database Engine (aka MDB files) that can be exploited through Microsoft Word. A few minutes ago Microsoft has posted more details about this issue on the MSRC blog. Summarizing:

• The Jet Database Engine vulnerability is well-known since March 2005. The main issue now is that it can be exploited through a new attack vector, Microsoft Word (specifically two DOC files), avoiding the mitigations enforced by Outlook and Exchange over this unsafe file type (MDB).
•  Microsoft is currently working on the fixes, evaluating if an update may prevent Word from opening MDB files, and checking how to apply the fixed msjet40.dll currently available for Windows Server 2003 SP2, Windows Vista, and beta versions of Windows XP SP3 in other OS versions.
•  In the meantime, apart from the general recommendation of not opening untrusted MS Word files, you can follow the two workarrounds detailed on the initial advisory:
  • Computer-based workarround: Restrict the Microsoft Jet Database Engine from running through the "cacls" command, used to modify the access control lists (ACLs) of files. Applications requiring the Jet Database Engine will not function.
  • Infrastructure-based workarround: Block specific files at your mail gateway based on string signatures (if it provides file inspection capabilities). The associated strings plus implementation details for specifc mail gateways are detailed on the advisory.

Future updates on the MSRC blog.

--
Raul Siles
www.raulsiles.com